In an increasingly digital global economy, Kenyan businesses routinely transfer personal data across borders whether when storing customer databases on foreign cloud servers, using international software-as-a-service (SaaS) platforms, or sharing employee records with global parent companies. However, navigating these transfers requires strict adherence to Kenya’s legal and regulatory framework.
The Legal Framework
Cross-border transfers in Kenya are governed primarily by Section 48 and Section 49 of the Data Protection Act, 2019, alongside the Data Protection (General) Regulations, 2021. Further clarity has been provided through guidance notes issued by the Office of the Data Protection Commissioner (ODPC).
Under the statutory framework, data controllers and data processors are prohibited from transferring personal data out of Kenya unless specific legal conditions and safeguards are satisfied.
Key Requirements for Overseas Data Transfers
To legally transfer personal data outside Kenya, businesses must ensure compliance with one or more of the following mechanisms:
1. Appropriate Safeguards and Proof of Adequate Protection: Transfers are permitted if the destination country provides an adequate level of data protection substantially similar to Kenya’s framework, or if the transferring entity provides appropriate safeguards (e.g., standard contractual clauses, binding corporate rules, or certification mechanisms).
2. Standard Contractual Clauses (SCCs): Data controllers and processors must enter into legally binding contracts containing approved data protection clauses with foreign recipients, binding them to process data in line with Kenyan privacy principles.
3. Explicit Data Subject Consent: In the absence of an adequacy decision or standard safeguards, transfers may occur if the data subject gives explicit, informed consent after being advised of potential risks.
4. Data Protection Impact Assessments (DPIAs): When cross-border processing presents high risks to individuals’ rights, businesses must perform a DPIA prior to executing the transfer.
5. Data Localization Requirements: Pursuant to the General Regulations, strategic public data, health records, and certain critical infrastructure data must be processed and stored locally within servers located in Kenya, unless explicit exemptions apply.
Practical Action Points for Kenyan Entities
To maintain compliance and mitigate regulatory risks, commercial entities operating in Kenya should take the following steps:
● Audit Data Flows: Map all current international data transfers, identifying foreign software vendors, cloud service providers, and affiliated entities receiving data.
● Review Service Agreements: Ensure cross-border vendor contracts incorporate compliant Standard Contractual Clauses and robust confidentiality commitments.
● Update Privacy Notices: Provide full transparency to data subjects regarding where their personal data is stored or processed outside Kenya.
● Engage Data Protection Experts: Regularly review ODPC guidance notes to keep internal corporate governance aligned with emerging regulatory practice.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice.